CVE-2024-36472: Medium severity debian/gnome-shell vulnerability
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36472?
CVE-2024-36472 is considered a high severity vulnerability due to the potential for untrusted JavaScript code execution.
How do I fix CVE-2024-36472?
To fix CVE-2024-36472, upgrade to gnome-shell version 45.8 or later.
What are the risks associated with CVE-2024-36472?
The risks include unauthorized resource consumption and potential exposure to malicious code execution.
Which versions of gnome-shell are affected by CVE-2024-36472?
Versions of gnome-shell up to 45.7 are affected by CVE-2024-36472.
Can an adversary exploit CVE-2024-36472 remotely?
Yes, an adversary controlling a local Wi-Fi network can exploit CVE-2024-36472 without user confirmation.